wp_magic_quotes() │ WP 3.0.0

Changes global variables $_GET, $_POST, $_REQUEST, $_COOKIE, $_SERVER - adds magic quotes to their values.

Forcibly updates the variable $_REQUEST by making it a combined array from $_GET + $_POST.

The function removes escaped slashes if the server sets them and then adds them back using the function add_magic_quotes().

When it triggers

This function triggers on every request in WordPress. Therefore, in the WordPress environment, all data specified in the global variables is always escaped!

The function triggers immediately after the event plugins_loaded. That is, after the plugin files are loaded and the plugins are activated (initialized). But before the main WordPress request is made - wp(), before the theme and its functions.php file are loaded, and before the event init.

What are magic quotes?

Magic Quotes is the process of automatically escaping incoming data in a PHP script. The purpose of such escaping is to simplify development for beginners.

Automatic escaping has been deprecated since PHP 5.3 and removed since PHP 5.4. However, in the WordPress environment, this escaping still works. This is done to maintain a consistent standard for incoming data.

Magic quotes escape the following characters with a backslash: ' " \ and NULL. The function addslashes() or its equivalent in WordPress wp_slash() behaves similarly.

This is an internal WP function

This function has no usage examples. Because it does not need to be used anywhere, it is automatically called immediately after the event plugins_loaded.

This feature of WordPress needs to be known to understand how incoming data will look when developing themes and plugins.

Internal function — this function is designed to be used by the kernel itself. It is not recommended to use this function in your code.

1 time — 0.000084 sec (very fast) | 50000 times — 1.83 sec (fast) | PHP 7.0.8, WP 4.6.1

No Hooks.

Returns

null. Nothing

Usage

wp_magic_quotes();

Examples

0

#1 Remove backslashes where they are unnecessary

When you receive a JSON string, you need to clean it up in order to parse it later and use it in your code.

$json = strval( $_POST['urls'] );

// Unfortunately, WP applies magic quotes to POST data.
if ( function_exists('wp_magic_quotes') && did_action('plugins_loaded') ) {

	$json = stripslashes( $json );
}

Changelog

Since 3.0.0 Introduced.

wp_magic_quotes() code WP 6.9

wp-includes/load.php 
function wp_magic_quotes() {
	// Escape with wpdb.
	$_GET    = add_magic_quotes( $_GET );
	$_POST   = add_magic_quotes( $_POST );
	$_COOKIE = add_magic_quotes( $_COOKIE );
	$_SERVER = add_magic_quotes( $_SERVER );

	// Force REQUEST to be GET + POST.
	$_REQUEST = array_merge( $_GET, $_POST );
}

Uncategorized